Re: Central Audit Server with Prelude and Prewikka - RHEL5

[Dan Gruhn <Dan.Gruhn@groupw.com>]

Steve,

Thanks for the advice.  I was wondering about duplicating those 
information streams and needed the encouragement to go ahead.

One thing that did come up, I changed a lot of "localhost" references in 
the "Audit + Prelude HOWTO" and in the /etc/prelude/default/client.conf 
files to my actual server name (master) and I also changed a line in 
/etc/prelude-manager/prelude-manager.conf from

listen = 127.0.0.1

to

listen = master

All of these changes required me to revoke my old prelude-manager 
registrations under "localhost" and re-register all of the sensors to 
"master".  Perhaps I didn't need all of this but it is all working now 
(except for my 5.2 SELinux problem).

I'm running prelude-lml on the master and I'll be figuring out if I 
should run it on each node or it will pick up everything from the 
master's /var/log/messages file.  I'm thinking it would be better to 
keep things separate but I'll be testing.

If anyone can tell me if some of those "localhost" changes were not 
necessary it would be helpful to know for future reference.  I could 
update the "Audit + Prelude HOWTO" with what I've found and send it to 
back to Steve if that would be useful.

Dan


Steve Grubb wrote:
> On Friday 13 February 2009 03:11:26 pm Dan Gruhn wrote:
>   
>> I'm using Prelude and Prewikka to view events and I see the master as a
>> sensor/source and its events, but I don't see the node.  I thought that
>> once the audit/syslog information was making it to the central files the
>> rest would also work but that doesn't seem to be the case.
>>     
>
> Prelude has its own messaging protocol. It picks things out of its 
> configuration files to fill in various fields in its data packets. So, if you 
> have the audit-prelude sensor reading aggregated logs, it won't know these 
> are coming from all over the place.
>
> To use prelude the way it wants to be setup, you would have the audisp-prelude 
> sensor on each machine sending to a central prelude-manager. Let audit send 
> its data to its aggregator and prelude send its own data to its aggregator. 
> Yes, there will be duplication...but it will work better.
>
> -Steve
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>   

-- 
Dan Gruhn
Group W Inc.
8315 Lee Hwy, Suite 303
Fairfax, VA, 22031
PH: (703) 752-5831
FX: (703) 752-5851